From 081ac72e588ebf21df5796b30ba98a2780e08183 Mon Sep 17 00:00:00 2001 From: Nandan Prabhu Date: Mon, 20 Jul 2026 14:24:42 +0530 Subject: [PATCH] docs: remove online_refresh_tokens flag mention, document Ephemeral Sessions limitation Online Refresh Tokens are Early Access, not gated by a tenant feature flag, so drop the incorrect reference. Also document that Online Refresh Tokens do not yet support resource servers with Ephemeral Sessions enabled. --- EXAMPLES.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/EXAMPLES.md b/EXAMPLES.md index 4863a879..e9255a97 100644 --- a/EXAMPLES.md +++ b/EXAMPLES.md @@ -846,7 +846,10 @@ Read more about [Online Refresh Tokens](https://auth0.com/docs/secure/tokens/ref > [!IMPORTANT] > Online access requires DPoP. Sender-constraining the token via [DPoP](#device-bound-tokens-with-dpop) is mandatory because the ORT is non-rotating — binding it to the browser's key pair is what mitigates token replay if it is exfiltrated. You must set `useDpop={true}` explicitly; the SDK does not enable it for you. > -> This also requires the `online_refresh_tokens` flag to be enabled for your Auth0 tenant, and `allow_online_access` to be enabled on the resource server you log in with (on by default). +> This also requires `allow_online_access` to be enabled on the resource server you log in with. + +> [!WARNING] +> Online Refresh Tokens do not currently support resource servers with **Ephemeral Sessions** enabled. If a resource server has both `allow_online_access` and "Allow for Ephemeral Sessions" enabled, the authorization server issues an Online Refresh Token at login that is then rejected with `invalid_grant` (`"Unknown or invalid refresh token"`) on the very next refresh — this is a known backend limitation, not a client-side defect. Until Ephemeral Sessions support is added for Online Refresh Tokens, disable "Allow for Ephemeral Sessions" on any resource server used with `refreshTokenMode: RefreshTokenMode.Online`. ### Enabling Online Access